This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] GitLab CE and EE fix 2 vulnerabilities
GitLab fixes 2 vulnerabilities in GitLab Community Edition (CE) and Enterprise Edition (EE) with versions 17.5.1, 17.4.3 and 17.3.6 [1].
An authenticated remote attacker is able to carry out an XSS attack [2].
The vulnerability is present in product:
- GitLab; >=15.10, <17.3.6; >=17.4, <17.4.3; >=17.5, <17.5.1
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
More information:
- CVE-2024-8312 at cve.org, NVD
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org
The vulnerability was publicly disclosed 24. 10. 2024.
An authenticated remote attacker is able to carry out a DoS attack by uploading a specially crafted XML manifest file [3].
The vulnerability is present in product:
- GitLab; >=11.2, <17.3.6; >=17.4, <17.4.3; >=17.5, <17.5.1
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
More information:
- CVE-2024-6826 at cve.org, NVD
- CWE-770: Allocation of Resources Without Limits or Throttling at cwe.mitre.org
The vulnerability was publicly disclosed 24. 10. 2024.
Links
By CESNET, z.s.p.o. Michaela Ručková on 29. 10. 2024.